This invention relates to networking, and more particularly to monitoring and analysis of network traffic.
In a computer networking environment, users may install and deploy monitoring and/or troubleshooting tools for observation of network traffic and network installation and maintenance. It is common to configure a set of network span or mirror ports on a switch/router/etc., install network taps, install devices inline, etc. A network span or mirror combines the data from multiple (one or more) network interfaces on a switch/router/etc. such that the data can be exported on a single port. The network monitoring and analysis devices can then get extended visibility across numerous network segments from a single interface. A network tap allows the user to install a device inline between points on a network and gain similar extended visibility into the network segments.
In many cases, the network environment is complex enough that, with the best intentions, a user will install taps or spans incorrectly. Typical configuration issues include but are not limited to:
1. Oversubscription of the span (including too many hi-bandwidth data flows such that the amount of data aggregated across the spanned ports can exceed available throughput capacity of the span port).
2. Incorrectly places taps (placement such that part of the data is missing due to the route the data takes across the network).
3. Incomplete configuration (span or tap configuration such that part of the data is missing).
4. Monitoring device dropping data (the device receiving the data is unable to process all of the data).
These issues can result in false determination that network problems exist, leading to wasted time and resources trying to track non-existent network problems.